A heap-based buffer overflow in the Windows Bluetooth Service can be triggered by an unauthorized user to gain elevated privileges. The flaw exposes a bug where excessive or malformed input overflows a heap buffer, allowing the attacker to execute arbitrary code with greater rights, potentially enabling full control over the host system. The vulnerability is classified under CWE-122.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, the 26H1 variant; and Microsoft Windows Server 2016, 2019, 2022, and 2025, including Server Core installations are affected. These are listed in the CVE vendor/product data and correspond to the relevant CPE entries.

The CVSS score of 8.8 indicates a high severity level. With no EPSS score available and the issue absent from the CISA KEV catalog, the current exploitation probability is uncertain, but the potential for local privilege escalation is significant. The likely attack vector is local or adjacent network access to the Bluetooth service, implying that an attacker with proximity or network connectivity could exploit the overflow. The lack of a public exploit in the advisories suggests that exploitation may require more specialized effort, yet the impact of a successful exploit remains severe.